Hacker News Reader

Comment by reality_czech | Hacker News Reader

Yeah, you would have to be stupid to self-host email these days. If you're an individual person, it's way too time-consuming to set everything up properly. If you're a company, there is a very high risk that you'll get put on some anti-spam blacklist or other for doing one of 10,000 harmless things (or even not doing anything wrong at all, but just sharing a block of IPs with a bad guy). And then your mails will get silently dropped, and you might never know that it happened. You just... won't get replies from customers or business partners that you were expecting.

The anti-spam zealots ruined email for everyone, and they don't even have the honesty to admit what they did. "Hilarious and infuriating" is right.

View on HN

> If you're an individual person, it's way too time-consuming to set everything up properly.

A few minutes to configure smtpd. A few more to update DNS settings.

A lifetime of maintenance. Not in terms of hours, but it's something that requires monitoring. Something that will fail at inconvenient times. Something that requires security updates.

And if that's sendmail smtpd, it's not "a few minutes" to configure if you're unfamiliar with it.

It's opensmtpd and my seven-line config took literally minutes to initially write back when I first did it years ago, with no prior experience.

It's required basically no maintenance at all from me. As for monitoring, I check my mail daily anyway and I will notice it if it stops flowing.

A few weeks ago I actually moved and took down my server. I took an old netbook and made it a new, temporary server. Again that took me literally minutes.

Thankfully smtp is a robust protocol so if something fails, you normally have a couple days to fix it before mail starts dropping.

But what do you do when you're using third-party email service and they decide to kick you out all of a sudden? Happened to me with Google. Happened to many other people as well, also with other providers.

What do you use for antispam?

I ran my own debian-exim for about a decade until I got tired of the care and feeding. opensmtpd does look suitably low-maintenance and I might pick it if I ever wanted to do this again, but it was released after I gave up being an email admin. I still have the mail domain, but having the same email address for sixteen years means ending up on a lot of spam lists.

You run your own server so you can easily set it up to accept any email matching some simple rules. This means you can give a different email address to every online service you use. If one of them starts getting spam, blackhole it.

I have been running my own email server this way for about 10 years and I have never needed any kind of antispam measure except a simple .procmailrc.

And everything works just peachy. Until it doesn't.

The problems are that:

1) the determination of "works well" or "doesn't" is almost entirely out of your hands. A DNSBL or major email service provider decides they don't like the tilt of your kilt and it's titsup.com for you. Been there, done that, shredded the t-shirt.

2) How much of a problem this becomes is a matter of who's inconvenienced, how much, and what alternative contact channels they've got. Generally, though, it's something of a PITA.

Things can work well for a long time. Or not. You're just never quite sure when they'll blow up.

It's the anti-spam zealots, and not the spammers themselves, that "ruined email for everyone"?

More of a Mutually Assured Destruction scenario.

It's both. The spam war causes a lot of collateral damage. For a decade I ran a mail server for a small client. Yes, they ran a ~15k membership newsletter, yes some cranky people would flag as spam since they were too lazy to click UNSUBSCRIBE, but that's small business for you.

Self hosting was once fun; now I hate it. Now I would only ever recommend getting a business gmail setup and using something like Mail Chimp. Not because I like either option, but fighting with blacklist operators and arrogant mail admins jaded me and now I refuse to support email servers for people.

Don't get me started on the web hosting side of this equation.

The raw mail flow may be useless without filtering, but blocking legit mail from a tainted IP addresses (tough to avoid anymore for the small business) is simply counter-productive. Our job as mail admins is to send and receive mail. We should let the receiving mail server tag the mail and let the mail clients filter.

We should never, never, never reject a message during the SMTP transaction. Just never.

There should be a new Fry meme: Shut up and accept my SMTP connection!

Allowing clients to filter sounds great until you look at the volumes of spam that major (and even minor) email service providers handle. SMTP-time rejection is the only feasible way to handle it.

What you're seeing (and a conversation I've had numerous times, particularly with some individuals who seem to think it's all some Vast Conspiracy Against Personal Communications) is simply the challenges of dealing with email on a scale where you've got more peers than most people have email contacts -- where a peer is another peering email system.

It turns into a reputation management system. And it's a lot easier to deal with those reputations when you've got a handful of major public providers (Google, Microsoft, Yahoo, Aol, Inbox, etc.), and a few thousand major corporations. Once you get outside of the Fortune 500, even corporate emails get hard to deal with. At Krell Power Systems, we had a customer who required us to provide our email server IPs (already listed in both SPF and DKIM, natch) before they'd allow mail from us. The fact that they run a few machines powered by U-235 and are concerned about SCADA threats might have something to do with that level of paranoia.

But allowing all spam through, storing it, and relying on users / client software to filter it is expansive and quite error prone. The good thing about SMTP-time rejection is that it's unambiguous: any well-formed server will recognize that it's failed delivery, and in most cases the message is immediately bounced back to the sender. Accepting email and later trying to determine whether or not it's legitimate risks spoofing, Joe-Jobs, and silently-lost messages. That's actually far worse.

Much as I wish everyone could simply run their own servers, with systems as they stand now, it's just not possible.

Reply on news.ycombinator.com